Privacy Policy

Effective date: 31 July 2026 · App: CloudStream TV (com.cloudstream.app) · Publisher: CloudStream

1. Who we are

The data controller for CloudStream TV app licensing, activation, and phone-to-TV pairing services is CloudStream, operating at https://cloudstream.pro/. For privacy questions contact support@cloudstream.pro.

2. Information we collect

2.1 Data stored on your device (local only)

Unless you choose to back up or share it, the following stays on your Android device in app storage (Room database, DataStore, or encrypted preferences):

• Provider configuration — names, server URLs, M3U playlist URLs, and Xtream/Stalker usernames. Passwords are encrypted with Android Keystore (CredentialCrypto).
• Catalog cache — channel, movie, series, episode, category, and EPG metadata fetched from your IPTV provider.
• Playback data — watch history, resume positions, favorites, search history, hidden channels/categories, and player compatibility notes.
• App preferences — language, layout, guide settings, parental-control level, and player options. Parental PINs are stored as salted hashes, not plain text.
• License state — trial start time, activation plan, activation code, optional customer email, and server-validated access flags.
• Downloads & recordings — metadata and files you explicitly save to device storage.
• Crash diagnostics — if the app crashes, a local text report (device model, app version, stack trace with URLs and credentials redacted) is saved on-device. It is not uploaded automatically. You may view, share, or delete it in Settings.

Android backup is enabled (android:allowBackup="true"). When your device backup is on, the app can include your provider database, preferences, and settings in Google’s device backup and device-to-device transfer (see backup_rules.xml). In-place app updates always keep your playlists and settings. Uninstalling the app still removes local data unless you exported a backup file, used Google Drive backup, or restore from a device backup.

2.2 Data sent to CloudStream servers

When you use CloudStream activation, subscription sync, or phone pairing, the app contacts https://cloudstream.pro/customers/ and may transmit:

Data	Purpose	When sent
Android device ID (ANDROID_ID) or registered device ID	License binding, pairing, playlist proxy	Activation, status sync, pairing
MAC address (hardware if available, otherwise a deterministic value derived from device ID)	Device identification for admin support and playlist access	Activation, status sync, pairing
Hardware fingerprint (hashed device characteristics: model, board, screen size, SDK)	TV Device ID display and admin lookup	Status sync
Device model / device name	Support and admin dashboard	Status sync, pairing session
Activation code	Validate app license or subscription plan	When you enter a code
Pairing token	Link your phone browser session to the TV	QR / phone pairing flow
Email address	Associate your CloudStream customer account	Returned by server after successful activation (if applicable)

We do not receive your IPTV stream content. Playlist credentials you add may be submitted to your provider’s servers or, for CloudStream-managed customers, to our customer API solely to retrieve your assigned playlist.

2.3 Data sent to your IPTV provider

To play content, the app connects directly to servers and URLs you configure (Xtream API, M3U, Stalker portal, EPG sources, etc.) and sends credentials required by that provider. CloudStream does not control those third-party services. Review your provider’s privacy policy for their practices.

2.4 Optional Google services

• Google Sign-In & Drive backup (optional) — If you sign in, Google processes your account per Google’s Privacy Policy. The app uploads a configuration backup (providers without passwords, favorites, preferences) to your Google Drive appDataFolder, invisible in the normal Drive UI.
• Google Cast (optional) — If you cast to a Chromecast device, Google Cast framework may process playback metadata per Google’s policies.

2.5 What we do not collect

• No Firebase, Crashlytics, Google Analytics, or third-party advertising/tracking SDKs.
• No precise GPS location, contacts, SMS, photos, microphone, or calendar access.
• No sale of personal data.

3. How we use information

• Provide and maintain the media player and TV guide features.
• Validate app licenses, trials, and CloudStream customer subscriptions.
• Enable phone-to-TV pairing and customer playlist delivery.
• Remember your preferences, favorites, and playback position on-device.
• Improve stability when you voluntarily share a crash report.

4. Legal bases (EEA/UK users)

We process data based on: (a) performance of a contract — providing the app and your licence; (b) legitimate interests — fraud prevention, device binding, and service security; (c) consent — optional Google Sign-In/Drive backup and notification permission.

5. Data retention

• On-device data — retained until you delete it in the app, clear app storage, or uninstall.
• CloudStream server records — retained for the life of your customer account and as needed for billing, support, and legal compliance, then deleted or anonymized. See §11, How to delete your data for retention specifics and how to request earlier deletion.
• Google Drive backups — retained until you delete them or uninstall the app (Google may remove appDataFolder data on uninstall).

6. Sharing and disclosure

We may share data with:

• Your IPTV provider — to authenticate and deliver streams you request.
• Google — only if you use Sign-In, Drive backup, or Cast.
• Service providers — hosting and infrastructure for cloudstream.pro, under confidentiality obligations.
• Authorities — when required by law or to protect rights and safety.

We do not share data with data brokers or ad networks.

7. Security

Provider passwords are encrypted at rest. Parental PINs are hashed with PBKDF2. Network traffic to CloudStream uses HTTPS. The app allows cleartext HTTP where required by user-supplied IPTV providers (usesCleartextTraffic). You are responsible for using lawful providers and secure credentials.

8. Children’s privacy

CloudStream TV is not directed at children under 13. The app includes optional parental controls, but users may access third-party streams with mature themes depending on their IPTV subscription. Parents and guardians are responsible for provider choice and PIN configuration.

9. International transfers

CloudStream servers may be located outside your country. Where required, we use appropriate safeguards for cross-border transfers.

10. Your rights and choices

• Access / export — export app settings and provider list via Settings → Backup (passwords excluded from export).
• Deletion — see §11, How to delete your data for full steps, including on-device deletion and requesting server-side account deletion.
• Opt-out — do not use Google Sign-In, Drive backup, or Cast if you prefer not to interact with Google services.
• Notifications — disable in Android system settings.
• EEA/UK rights — you may have rights to access, rectify, erase, restrict, object, and port data, and to lodge a complaint with your supervisory authority.

11. How to delete your data

You can delete most CloudStream TV data yourself, right now, with no need to contact us:

• Provider playlists & credentials — Settings → Playlists → remove a provider.
• Watch history, favorites, resume positions — Settings → Playback → clear history.
• Crash diagnostics — Settings → Support → view or delete saved crash reports.
• Google Drive backup — remove it from your Google Account at myaccount.google.com/permissions, or it is deleted automatically when you uninstall the app.
• Everything on-device — uninstalling the app removes all local app data immediately, except a backup file you exported yourself or synced to Google Drive.

To delete data held on CloudStream's servers — your device/license record, activation history, and any stored email — contact us with (1) your Device ID or activation code (Settings → Activation) or the email used at activation, and (2) the words "data deletion request", via:

• Email: support@cloudstream.pro
• WhatsApp: +44 7537 105407

We verify the request belongs to the device/account owner, then act within 30 days:

• Deleted — device identifiers, hardware fingerprint, activation/pairing history, and any stored email are permanently removed from our active database.
• Retained where legally required — payment/billing records (tax, accounting, and fraud-prevention obligations) and records needed to defend against license abuse, kept only as long as applicable law requires, then deleted or anonymized.

Deleting your server-side record ends license validation for that device — you would need to reactivate to use a paid plan again on it.

12. Google Play distribution

Play Store builds disable sideloaded app updates, third-party plugin APK installation, and offline license bypass codes. Updates are delivered through Google Play. Self-update checks contact cloudstream.pro or GitHub only in non-Play builds.

13. Copyright and user responsibility

CloudStream TV is a player only. It does not bundle copyrighted channels, logos, or media. You must have lawful rights to any playlist or stream you add. CloudStream is not responsible for unauthorized content accessed through user-supplied credentials.

14. Changes to this policy

We may update this policy. Material changes will be posted at this URL with a revised effective date. Continued use after changes constitutes acceptance.

15. Contact

CloudStream
Website: cloudstream.pro
Email: support@cloudstream.pro
WhatsApp support: +44 7537 105407